MavenPackage

org.pf4j:pf4j

4 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2025-70952High 7.5
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names…
Affected: fixed in 3.14.1.
Fixed in 3.14.1 (released Jan 6, 2026, 78 days before disclosure).
The latest release, 3.16.1, is not affected.
CVE-2023-40828Unrated
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the…
Affected: through 3.9.0.
Fixed in 3.10.0 (released Sep 6, 2023, 9 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.16.1, is not affected.
CVE-2023-40827Unrated
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the…
Affected: through 3.9.0.
Fixed in 3.10.0 (released Sep 6, 2023, 9 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.16.1, is not affected.
CVE-2023-40826Unrated
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the…
Affected: through 3.9.0.
Fixed in 3.10.0 (released Sep 6, 2023, 9 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.16.1, is not affected.